I propose that defining DKIM2 interactions for the RFC5322 From header field become a separate document along with defining DMARC interactions. I do like the current draft-ietf-dkim-dkim2-spec's intentional separation of policy from authentication. In fact a separate document can better make that separation more distinct and clear. -Wei
On Mon, Aug 31, 2026 at 7:34 AM Richard Clayton <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > Several people have spoken up about the interaction between DMARC and > DKIM2 -- and the issues that arise when the RFC5322 From header field is > changed by an intermediary. > > There is a straightforward way to address this -- which I would commend > to the working group. > > We update the spec to say that when a From field is first placed into a > message (ie it sits alongside an i=1 DKIM2-Signature) or when it is > changed by an intermediary (there is a recipe that shows that it has > been changed at a particular hop) then DKIM2 will insist that there is > match between the d= domain being used to sign and the domain in the > RFC5322 From header field. > > The appropriate match would seem to be the "relaxed" match described in > #9.4 .. viz if d= and the domain in the RFC5322 From header field are > not identical then remove labels until the values are identical or until > there are no labels remaining in which case there is no match. > > Since in the real world no-one can sign for .com (or whatever your > publicly used TLD may be) this is just as safe as the MAIL FROM match > already required (and we don't need to wander into the world of tree- > walks or the PSL). > > Since this fits with what a number of people have been asking for, > unless there is outrage (or an important use case where this would be > impossible) I will put appropriate text into spec-07 so that the detail > of the wording (rather than just the concept) can be considered by the > Working Group. > > - -- > richard @ highwayman . com "Nothing seems the same > Still you never see the change from day to day > And no-one notices the customs slip away" > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBapWQgmHfC/FfW545EQIf0wCgjNlZqZ19T/R52pHjBh5PXsXeBSQAn1ya > ypqXc1AYxPSFiM+YIThRE5Dq > =iOeT > -----END PGP SIGNATURE----- > > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
